Security audit

OpenClaw Hardening

Security checks for vulnerabilities and agentic risk

Overview

This hardening skill is purpose-aligned, but it asks users to run mutable third-party installers and persistent interception services with root-level system access.

Review this skill carefully before installing. Do not run the one-line installer or latest-release binary commands on a production host unless you first pin exact versions, verify checksums or signatures, inspect the scripts, and understand the SSH, firewall, systemd, proxy, and root-service changes. Prefer a test machine and an uninstall/rollback plan.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:41
Finding: Mutable Remote Installation Script Executed as Root
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:47
Finding: Unverified Third-Party Executables Installed into Privileged Paths
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:59
Finding: Unverified Interception Binary Registered as a Persistent Root Service
Content: View full analysis
/etc/systemd/system/chainwatch-intercept.service << 'EOF' [Unit] Description=Chainwatch Intercept Proxy After=network-online.target Before=openclaw-gateway.service [Service] Type=simple ExecStart=/usr/local/bin/chainwatch intercept --port 9999 --upstream https://api.anthropic.com --profile clawbot --audit-log /var/log/chainwatch/intercept-audit.jsonl Restart=always RestartSec=3 User=root Environment=HOME=/root NoNewPrivileges=true ProtectSystem=strict ReadWritePaths=/var/log/chainwatch MemoryMax=256M [Install] WantedBy=multi-user.target EOF mkdir -p /var/log/chainwatch systemctl daemon-reload && systemctl enable --now chainwatch-intercept ``` The OpenClaw containment wrapper is also registered for startup: ```ini # /etc/systemd/system/openclaw.service [Unit] Description=OpenClaw Gateway under Chainwatch enforce After=network.target [Service] Type=simple ExecStart=/usr/local/bin/chainwatch enforce --profile openclaw --fallback -- openclaw gateway run Restart=on-failure RestartSec=5 Environment=HOME=/root [Install] WantedBy=multi-user.target ``` ```bash systemctl daemon-reload && systemctl enable openclaw ``` A continuous observation service is additionally proposed: ```ini # /etc/systemd/system/chainwatch-observe-openclaw.service [Unit] Description=Chainwatch eBPF observer for OpenClaw gateway After=network.target [Service] Type=simple ExecStart=/bin/bash -c 'PID=$(pgrep -f openclaw-gateway); [ -z "$PID" ] && exit 1; exec /usr/local/bin/chainwatch observe --pid $PID' Restart=on-failure RestartSec=10 [Install] WantedBy=mu ...[truncated 2258 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:278
Finding: Security Enforcement Fails Open to Observe-Only Operation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (43)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
## Layer 2: Chainwatch — Command Safety (5 min) Chainwatch blocks destructive commands (rm -rf /, sudo su, curl|sh, fork bombs) and routes all LLM API traffic through an intercept proxy. ### Install

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.
md
## Layer 2: Chainwatch — Command Safety (5 min) Chainwatch blocks destructive commands (rm -rf /, sudo su, curl|sh, fork bombs) and routes all LLM API traffic through an intercept proxy. ### Install

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 412)May include surrounding context.
md
## Layer 2: Chainwatch — Command Safety (5 min) Chainwatch blocks destructive commands (rm -rf /, sudo su, curl|sh, fork bombs) and routes all LLM API traffic through an intercept proxy. ### Install

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
## Layer 2: Chainwatch — Command Safety (5 min) Chainwatch blocks destructive commands (rm -rf /, sudo su, curl|sh, fork bombs) and routes all LLM API traffic through an intercept proxy. ### Install

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
## Layer 2: Chainwatch — Command Safety (5 min) Chainwatch blocks destructive commands (rm -rf /, sudo su, curl|sh, fork bombs) and routes all LLM API traffic through an intercept proxy. ### Install

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The command chains remote download directly into privileged execution, collapsing fetch and execute into a single step with no inspection boundary. This significantly raises the chance of undetected malicious or compromised installer content gaining root access.
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
Install

bash
curl -fsSL https://raw.githubusercontent.com/ppiankov/chainwatch/main/scripts/install-openclaw.sh | sudo bash

This one-liner does everything: installs chainwatch, creates clawbot profile, sets up intercept proxy as systemd service, configures ANTHROPIC_BASE_URL, hardens the host.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The guide claims the intercept proxy is 'non-bypassable', but the actual setup only relies on environment-variable routing. Any process that ignores, overrides, or unsets the base URL can bypass inspection and exfiltrate prompts or tool traffic directly to the provider.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Using 'rm -rf /tmp/old-data' as an endorsed wrapper example teaches the agent/operator pattern of destructive deletion under automation. In a security skill, examples should minimize the chance of users adapting them unsafely to more sensitive paths.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
Route risky commands through chainwatch:

bash
chainwatch exec --profile clawbot -- rm -rf /tmp/old-data # checked chainwatch exec --profile clawbot -- git push --force # checked

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Using 'rm -rf /tmp/old-data' as an endorsed wrapper example teaches the agent/operator pattern of destructive deletion under automation. In a security skill, examples should minimize the chance of users adapting them unsafely to more sensitive paths.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
Route risky commands through chainwatch:

bash
chainwatch exec --profile clawbot -- rm -rf /tmp/old-data # checked chainwatch exec --profile clawbot -- git push --force # checked

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: The guide treats 'git push --force' as a normal risky command to route through automation. Force-push can irreversibly rewrite history and cause data loss or integrity issues, especially if an agent is allowed to invoke it without strong approval controls.
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
bash
chainwatch exec --profile clawbot -- rm -rf /tmp/old-data # checked chainwatch exec --profile clawbot -- git push --force # checked

Safe read-only commands (ls, cat, grep, git status) don't need the wrapper.

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

Category: YARA Match
Confidence: 90% confidence
Finding: The skill contains agent-oriented examples of destructive filesystem and repository actions, specifically recursive deletion and force-push, which are dangerous patterns to normalize in automation guidance. Even when framed as 'checked', they can encourage autonomous high-impact operations with insufficient guardrails.
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
IC_BASE_URL": "http://localhost:9999" } }

Then restart gateway

text
For other providers, change --upstream: - OpenAI: `--upstream https://api.openai.com` + set `OPENAI_BASE_URL` - Custom: `--upstream https://your-provider.com` ### Usage Route risky commands through chainwatch: ```bash chainwatch exec --profile clawbot -- rm -rf /tmp/old-data # checked chainwatch exec --profile clawbot -- git push --force # checked

Safe read-only commands (ls, cat, grep, git status) don't need the wrapper.

What gets blocked

Blocked Allowed
rm -rf /, rm -rf ~ rm -f /tmp/file
sudo su, sudo -i mkdir, cp, mv
dd if=/dev/zero curl https://safe-url
curl | sh apt install, npm install
chmod -R 777 / chmod 600 specific-file
Fork bombs systemctl status

Key lesson

guarded mode is too aggressive for agents — it blocks mkdir, cp, touch. Use advisory mode with the denylist. The deny

Blocked	Allowed
`rm -rf /`, `rm -rf ~`	`rm -f /tmp/file`
`sudo su`, `sudo -i`	`mkdir`, `cp`, `mv`
`dd if=/dev/zero`	`curl https://safe-url`
`curl \| sh`	`apt install`, `npm install`
`chmod -R 777 /`	`chmod 600 specific-file`
Fork bombs	`systemctl status`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.
md
| Blocked | Allowed | |---------|---------| | `rm -rf /`, `rm -rf ~` | `rm -f /tmp/file` | | `sudo su`, `sudo -i` | `mkdir`, `cp`, `mv` | | `dd if=/dev/zero` | `curl https://safe-url` | | `curl \| sh` | `apt install`, `npm install` |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.
md
| Blocked | Allowed | |---------|---------| | `rm -rf /`, `rm -rf ~` | `rm -f /tmp/file` | | `sudo su`, `sudo -i` | `mkdir`, `cp`, `mv` | | `dd if=/dev/zero` | `curl https://safe-url` | | `curl \| sh` | `apt install`, `npm install` |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.
md
| Blocked | Allowed | |---------|---------| | `rm -rf /`, `rm -rf ~` | `rm -f /tmp/file` | | `sudo su`, `sudo -i` | `mkdir`, `cp`, `mv` | | `dd if=/dev/zero` | `curl https://safe-url` | | `curl \| sh` | `apt install`, `npm install` |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.
md
| Blocked | Allowed | |---------|---------| | `rm -rf /`, `rm -rf ~` | `rm -f /tmp/file` | | `sudo su`, `sudo -i` | `mkdir`, `cp`, `mv` | | `dd if=/dev/zero` | `curl https://safe-url` | | `curl \| sh` | `apt install`, `npm install` |

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.
md
| `rm -rf /`, `rm -rf ~` | `rm -f /tmp/file` | | `sudo su`, `sudo -i` | `mkdir`, `cp`, `mv` | | `dd if=/dev/zero` | `curl https://safe-url` | | `curl \| sh` | `apt install`, `npm install` | | `chmod -R 777 /` | `chmod 600 specific-file` | | Fork bombs | `systemctl status` |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.
md
| `sudo su`, `sudo -i` | `mkdir`, `cp`, `mv` | | `dd if=/dev/zero` | `curl https://safe-url` | | `curl \| sh` | `apt install`, `npm install` | | `chmod -R 777 /` | `chmod 600 specific-file` | | Fork bombs | `systemctl status` | ### Key lesson

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
md
## Prerequisites - OpenClaw installed and running - Root/sudo access - Linux (amd64) ## Layer 1: Host Hardening (2 min)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
## Prerequisites - OpenClaw installed and running - Root/sudo access - Linux (amd64) ## Layer 1: Host Hardening (2 min)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.
md
## Prerequisites - OpenClaw installed and running - Root/sudo access - Linux (amd64) ## Layer 1: Host Hardening (2 min)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 389)May include surrounding context.
md
## Prerequisites - OpenClaw installed and running - Root/sudo access - Linux (amd64) ## Layer 1: Host Hardening (2 min)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs users to modify SSH settings, enable a deny-by-default firewall, install services, and change permissions with root-level impact, but does not prominently warn about lockout, service interruption, or recovery planning. Users can accidentally cut off remote access or alter system behavior without adequate safeguards.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.
md
ufw default deny incoming && ufw default allow outgoing && ufw allow ssh && yes | ufw enable # Brute-force protection apt-get install -y fail2ban && systemctl enable --now fail2ban # Lock credentials chmod 700 ~/.openclaw/credentials

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
apt-get install -y fail2ban && systemctl enable --now fail2ban

Lock credentials

chmod 700 ~/.openclaw/credentials

text
## Layer 2: Chainwatch — Command Safety (5 min)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
## Layer 2: Chainwatch — Command Safety (5 min) Chainwatch blocks destructive commands (rm -rf /, sudo su, curl|sh, fork bombs) and routes all LLM API traffic through an intercept proxy. ### Install

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T08 · Insecure Dependencies

T06 · System Persistence

T09 · Insecure Skill Coding Practices

SkillSpector

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Chaining Abuse

Install

Intent-Code Divergence

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

Then restart gateway

What gets blocked

Key lesson

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

External Script Fetching

Tool Parameter Abuse

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Missing User Warnings

Session Persistence

Sudo/Root Execution

Lock credentials

Sudo/Root Execution